I'm beginning to rerip my entire music collection to ALAC using iTunes and since this is the last time I want to rerip, and since I'll probably transcode to FLAC at some point, I've been spending some time trying to verify that the rips really are lossless.

To that end, I ripped a song off of one of my CDs to ALAC using iTunes, and ripped the same file to FLAC using Max. I then copied the original AIFF file from the CD to my hard drive.

I then used Max to transcode these FLAC and ALAC files back to AIFF, and MD5'd the resulting files against the original. If the process were truly lossless, I'd expect identical checksums, but they are not identical. I tried various settings for the AIFF encoder, 32 bit float, signed and unsigned 16 bit PCM, etc.

Is there a flaw in my process, or something else I should be trying, or what?

You really want the MD5 checksum of the audio data, not the file. I can't think of a good reason off the top of my head why the AIFF checksums wouldn't match, but it is totally possible that the files would differ but contain the same audio (ie 16-bit samples stored as 32-bit, different chunks, etc).

An easier way might be to encode everything to FLAC (using Max or command line flac, or both for comparison's sake), and use metaflac to check the MD5 sums of the audio itself and ensure they match.